Deciding whether a quantum state has secret correlations is an NP-complete problem 
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From the NP-hardness of the quantum separabihty problem and the relation between bipartite 
entanglement and the secret key correlations, it is shown that the problem deciding whether a given 
quantum state has secret correlations in it or not is in NP-complete. 
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Recent progress in theories and experiments on quan- 
tum key distribution (QKD) allows one to think QKD as 
the first successful application of quantum information 
science [H- However, minimal and essential physical in- 
gredients for QKD are still not clear. For example, the 
equivalence between bipartite entanglement and secret 
key generation is still unproved 0. Acin et al. Q showed 
that, under the assumption that legitimate parties mea- 
sure only single copies of the state and eavesdropper per- 
forms individual attack, secret bits can be asymptotically 
distilled from any two-qubit entangled state. Recently, 
in Ref. 0, it was shown that entangled states can be 
mapped into classical probability distributions contain- 
ing secret correlations and vice versa. It was also shown 
that, surprisingly, even from bound entangled states one 
can distill an arlsitrarily secure key Q. All these results 
give rise to a fundamental question about exact connec- 
tions between entanglement of a quantum state and the 
private key distillable from the state [7|. On the other 
hand, in computational science there is a long standing 
open problem called P vs. NP problem; Is an easy 
checkable problem always easy solvable^! Many prac- 
tical classical cryptography s^^tems such as RSA[9] and 
Elliptic curve cryptography [T^, flTj rely on difficulty of 
some mathematical problems in NP class for security, 
while security for quantum key distribution (QKD) sys- 
tems relies on physical laws. In this paper a relation 
between this famous computational complexity problem 
and quantum key distribution is investigated. More pre- 
cisely, we show that deciding whether a given quantum 
state has secret correlations (i.e., Iforni{X; Y\Z) > 0, see 
below) in it or not is in NP-complete class. 

Let us begin by shortly reviewing the secret key gen- 
eration from a given classical distribution P{X, Y, Z) of 
random variables X, Y, and Z. This distribution might 
have been obtained from measurements of shared states 
independently done by legitimate parties, Alice(Mx) and 
Bob(Mi'), and an eavesdropper Five{Mz)- Then, for a 
given P(X, Y, Z) a secret key rate S{X; Y\\Z) is the max- 
imum key generation rate from the distribution by local 
operations and public classical communication(LOPC). 



Similarly, one can define the information of formation 
Ifor7n{X; Y\Z) which is the amount of secret bits needed 
for preparing P{X, Y, Z). They satisfy a relationfl^ 



SiX;Y\\Z) <I{X;Y\Z)fa 



(1) 
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which states that as the entanglement cost is larger than 
or equal to distillable entanglement, so the amount of se- 
cret bits needed for preparing the distribution is larger 
than or equal to the amount of secret bits that is distil- 
lable from it. There is a well known following theorem 
on the relation between bipartite entanglement of a state 
and the secret correlations in it. 

Theorem 1 (Equivalence of bipartite entanglement and 
secret correlation), 5] Let \'iPabe) be a pure quantum 
state shared by Alice, Bob, and Eve, such that the state 
is a purification of Alice and Bob's bipartite density ma- 
trix pab ('i.e., PAB = trE{\i'ABE){tpABE\)- Then, pab 
is entangled if and only if there exist measurements of 
IV'abb) by Alice (Mx) and Bob (My), such that for any 
measurement by Eve (Mz), the corresponding probability 
distribution P{X,Y, Z) contains secret correlations,i.e., 
{X;Y\Z)>0. 

This theorem is proven by showing the existence of an 
entanglement witness from the measurement operators 
Mx and My . In this paper we will consider only bipartite 
states in 'Ha^'Hb where dim{TiA) = M and dim{HB) — 
N. 

Since Turing machines can not represent arbitrary real 
or complex numbers from now on we deal with only den- 
sity matrices of which representations [p] have rational 
entries with finite precision. Now we define a problem 
deciding whether a given state has secret correlations. 

Definition 1 (Quantum Secret Correlation prob- 
lcm(QSCORR)). Let [pab] be a rational bipartite mixed 
state having a purification \iPabe) ols described in The- 
orem{^ Given [pab], does any P{X,Y, Z) from [^Pabe) 
contain secret correlations, that is, I form{X;Y[Z) > 0? 

To tackle this problem we need the famous theorem by 
Gurvits,13., ,14] about deciding entanglement of a given 
density matrix on a (deterministic) Turing machine {i.e., 
an abstraction of ordinary computers). To understand 
the theorem let us recall some definitions in computa- 
tional complexity theory Q. We say that a problem A 
is polynomially reducible to another problem B if there 
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exists a polynomial-time algorithm that converts each in- 
put (instance) I A of A to another input Ig of B such that 
Ia is a j/es-instance of A if and only if Is is a yes-instance 
of B. In this case we denote this relation as A <p B. 
The NP (Non-deterministic Polynomial time) class is the 
set of decision problems that can be verified by a Turing 
machine in polynomial time. Many practical and impor- 
tant problems such as the factoring (a decision version) 
and the graph isomorphism problem belong to this class. 
The NP-hard class is the class of all problems B such 
that for every problem in NP there exists a polynomial 
time reduction to B. Many interesting physical prob- 
lems belong to this class |15|. The NP-complete class is 
an intersection of the NP class and the NP-hard class. 

One can naturally imagine the following separability 
problem of rational density matrices. 

Definition 2 (Rational quantum separability problem 
(EXACT QSEP)). Given a bipartite rational [p], is [p] 
separable ? 

Unfortunately, EXACT QSEP encounters a mathe- 
matical difficulty near the boundary of 5'M,Ar[il, [i3| 
about representing density matrices with rational num- 
bers. Here S'j\/^jv is a convex set of separable density ma- 
trices acting on Ha ® Hb. Instead, Gurvits considered a 
problem asking whether a given [p] is close to separable 
states [Tsj. 

Definition 3 (Weak membership problem (WMEM)). 
Given a rational vector [p] and a rational 6 > 0, assert 
that either 

[p] e SiSM,N,S), or (2) 
[p] i SiSM,N,-S), (3) 

where S{Sm,n, ^) is a union of all 6-balls of which centers 
belong to Sm,n and S{Sm,n, —S) is a set of centers of S- 
balls where the S-balls are contained in Sm,n- 

Deciding, quantifying and distillating entanglement 
are subjects of intensive investigations in quantum in- 
formation communitvfisj . For example, an improved al- 
gorithm for quantum separability and entanglement de- 
tection on classical computers is suggested [19] and Do- 
herty et al. constructed families of operational criteria 
for separability based on semidefinite programs ^20J. De- 
spite all these efforts an efficient [i.e., polynomial time) 
algorithm for the separability problem is still unknown. 
The following seminal theorem due to Gurvits explains 
why the quantum separability problem is so hard. 

Theorem 2 (Gurvits). WMEM for Sm^n is NP-hard 
with respect to the complexity-measure {N-{- < [p] > + < 
6 >) if N < M < -'^(-'^^1) where <> denotes the size 
of the encoding. 

He demonstrated a polynomial time reduction 
from an NP-complete problem called KNAPSACK to 
WMEM(5'ji/^Ar) after a series of transformations. 



At first glance, it might seem that knowing Theorem [T] 
and Theorem[2]one can easily prove the NP-completeness 
of the problem deciding whether a given state has se- 
cret correlations(QSCORR). But real situation is com- 
plicated. To be proved as an NP-complete problem, the 
problem should be a decision problem. However, WMEM 
is not a decision problem, because inputs corresponding 
to states near the boundary of Sm,n can give both pos- 
sible answers [l^. To avoid this ambiguity loannou de- 
signed a decidable separability problem called QSEP 
asking whether, given a rational density operator [p], 
there exists a separable density operator cr close to [p] . 

Definition 4 (QSEP). Given a rational bipartite den- 
sity matrix [p] acting on TIa (S'Hb, and p-bit rational 
numbers e and S' ; does there exist a separable state a = 

Pi\c>:i){<^i\®\Pi){0i\, of which p-bit truncated and 

unnormalized version a = X]i=i Pi\<^i){<^i\ 
satisfying 

i) \[p] — a\2 < 5' , and 

ii) |(T — (7I2 < e? 

Here \ A—B\2 = \/ tr[fyA — B)^), Pi > is a p-bit rational 
number and pi > 0. 

We have adopted a slightly modified definition from 
the original one of QSEP in [l^ for our purpose, but 
basically two definitions are equivalent. 

Tiieorem 3. QSEP is in NP-completeUdt]. 

The NP-completeness of QSEP was proven by reduc- 
tion from WMEM. QSEP is carefully designed so that 
for an instance I{[p\,5) of WMEM one call QSEP with 
an instance /'([p],p, e, 5') such that 5 > 5' -\- e. To utilize 
this definition we consider a negation of QSCORR with 
error. 

Definition 5 (No Quantum Secret Correlation (NQS- 
CORR)). Given a rational bipartite density matrix [p], 
does there exist a state a, satisfying 

i) \[p\^a\2<5', 

ii) |(T — d\2 < e, and 

Hi) for any purification \^abe) of a as described in 
Theorem [II it contains no secret correlations, that is, 
IformiX;Y\Z) = 0? (Here S' ,e are p-bit rational num- 
bers and a is a p-bit truncation of a) 

Note that in the zero-error limit {6' ^ 0, e ^ 0) this 
problem reduces to the exact negation of QSCORR. 

Tiieorem 4. NQSCORR is in NP-complete. 

Proof. Basically, this theorem is a corollary of Theorem 
[T] and Theorem [31 If there is an algorithm that solves 
NQSCORR, then one can call the algorithm to solve 
QSEP. More precisely, given I[[p\,p,5' ,e) of QSEP one 
can caU NQSCORR with I' {[p\,p,5' ,e). NQSCORR re- 
turns yes if and only if QSEP returns yes because of the 
equivalence of bipartite entanglement and secret correla- 
tions (Theorem [T|) . This means NQSCORR is at least 
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as hard as QSEP which is in NP-complete class. There- 
fore NQSCORR is also in NP-hard. Furthermore, given 
a certificate {a, Mx, My , Mz) one can quickly {i.e., in 
a polynomial time) verify whether I form 

{X,Y\Z) from 

P{X, Y, Z) is positive or not. Hence NQSCORR is also in 
NP. Therefore, NQSCORR is in NP-complete class. □ 

The full reduction chain is KNAPSACK <p 
RSDF <p WVAL <p WMEM <p QSEP <p 
NQSCORR (See [H HI for definitions of the interme- 
diate problems). 

One may think of another related and more inter- 
esting problem asking whether a given bipartite den- 
sity matrix has non-zero secret key generation rate, 
that is, SiX,Y\\Z) > 0. Since Iform{X;Y\Z) > is 
not a sufficient condition but a necessary condition for 
S{X,Y\\Z) > 0, {i.e., there is a bound information [2]| ) . 
we could not answer to this interesting question within 
our approach. 



What our results imply is that there is no easy pro- 
cedure or simple formula for deciding whether a given 
quantum state gives rise to secret correlations ii P NP 
(which is usually believed). Conversely, as a byproduct 
of our results, if one can find a polynomial time algorithm 
solving the NQSCORR problem on a deterministic Tur- 
ing machine it means P = NP. Our results also reveal 
that the P vs. NP problem is not only related to classi- 
cal cryptography but also to quantum cryptography in a 
different way. 
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